 | 1 | initial version |
Both "Encrypted Alert" after the "Application data" are most likely a "TLS Close Notify". If the server sends a "HTTP 400" on HTTP level, than it makes sense it also closes the TLS layer after that (Encrypted Alert), followed by closing the TCP connection (the FIN).
"Application data" (= HTTP request or response) is only possible after a successful TLS handshake.
The TCP Reset is just a unclean shutdown of the TCP connection by the client.
The --verbose option of curl will show the TLS and HTTP communication.
